Opening for Cybersecurity GRC Consultant @ Mumbai

Quess IT Staffing; Mumbai; On-site; INR 900,000 - 1,300,000; Full time

Job summary

Quess IT Staffing seeks a cybersecurity GRC consultant with 3+ years of experience in consulting, IT audit or risk advisory. You will work directly with clients, translating regulatory requirements into practical controls and documentation.

The role covers ISO/IEC 27001 implementations, gap assessments, risk evaluations, policy development, and readiness activities, with emphasis on clear reporting and stakeholder communication in a fast-paced, client-focused environment in Mumbai.

Qualifications

• 3+ years of relevant experience in cybersecurity GRC consulting, information security consulting, IT audit, risk advisory, compliance, or related roles.
• Demonstrated experience working directly with clients in a consulting, advisory, audit, or assurance capacity.
• Hands-on experience in ISO/IEC 27001 implementation, gap assessment, internal audit, risk assessment, control documentation, or certification-readiness engagements.
• Strong understanding of NIST cybersecurity frameworks and their practical application in assessment and improvement programs.
• Working knowledge of DPDPA, GDPR, data privacy governance, data lifecycle controls, consent management concepts, data-subject rights, and privacy risk assessments.
• Experience with RBI, SEBI, and IRDAI cybersecurity and regulatory expectations; experience supporting BFSI clients will be preferred.
• Experience in Third-Party Risk Management, including vendor security assessments, supplier due diligence, risk classification, and remediation follow-up.
• Experience in cybersecurity posture assessments, cyber maturity assessments, cyber risk assessments, and compliance gap assessments.
• Familiarity with SOC 2 Type II requirements, Trust Services Criteria, control mapping, audit evidence, and readiness activities.
• Strong capability in developing and reviewing cybersecurity policies, standards, procedures, risk registers, control matrices, and compliance documentation.
• Experience in conducting cybersecurity training and awareness initiatives.
• Ability to interpret regulatory and framework requirements and translate them into practical, measurable, client-specific controls.
• Strong report-writing, documentation, presentation, stakeholder-management, and client communication skills.
• Ability to manage multiple concurrent engagements, meet project timelines, and work independently with limited supervision.

Skills

Cybersecurity GRC

Client engagement

ISO/IEC 27001

NIST frameworks

DPDPA/GDPR privacy

Regulatory expectations (RBI/SEBI/IRDA

Third-Party Risk Management

Cyber risk & maturity assessments

SOC 2 Type II familiarity

Policy & controls development

Training & awareness

Regulatory interpretation

Report writing & stakeholder comms

Tools

Microsoft Word

Microsoft Excel

Microsoft PowerPoint

Job description

• 3+ years of relevant experience in cybersecurity GRC consulting, information security consulting, IT audit, risk advisory, compliance, or related roles.
• Demonstrated experience working directly with clients in a consulting, advisory, audit, or assurance capacity.
• Hands-on experience in ISO/IEC 27001 implementation, gap assessment, internal audit, risk assessment, control documentation, or certification-readiness engagements.
• Strong understanding of NIST cybersecurity frameworks and their practical application in assessment and improvement programs.
• Working knowledge of DPDPA, GDPR, data privacy governance, data lifecycle controls, consent management concepts, data-subject rights, and privacy risk assessments.
• Experience with RBI, SEBI, and IRDAI cybersecurity and regulatory expectations; experience supporting BFSI clients will be preferred.
• Experience in Third-Party Risk Management, including vendor security assessments, supplier due diligence, risk classification, and remediation follow-up.
• Experience in cybersecurity posture assessments, cyber maturity assessments, cyber risk assessments, and compliance gap assessments.
• Familiarity with SOC 2 Type II requirements, Trust Services Criteria, control mapping, audit evidence, and readiness activities.
• Strong capability in developing and reviewing cybersecurity policies, standards, procedures, risk registers, control matrices, and compliance documentation.
• Experience in conducting cybersecurity training and awareness initiatives.
• Ability to interpret regulatory and framework requirements and translate them into practical, measurable, client-specific controls.
• Strong report-writing, documentation, presentation, stakeholder-management, and client communication skills.
• Ability to manage multiple concurrent engagements, meet project timelines, and work independently with limited supervision.
• Proficiency in Microsoft Word, Excel, PowerPoint, and documentation/reporting tools.

Mandatory Certifications

Candidates must hold the following valid certifications: